Which elements should an incident timeline document to support RCA and communications?

• A. Events only.
• B. Actions and timestamps.
• C. Events, actions, timestamps, responsible parties, and communications.
• D. Only final resolution time.

Answer: (C)

The key idea is that a useful incident timeline provides a complete, auditable record that supports both a root cause analysis and clear communications during and after an incident. It should capture what happened (events) to establish the sequence and context, what was done in response (actions) to show how the incident was handled, when each of these occurred (timestamps) to map timing and dependencies, who was responsible for each step (responsible parties) to assign accountability and clarify decision-making, and how information was shared (communications) to document notifications, updates, and stakeholder outreach. Events alone don’t show what was done in response; actions and timestamps without context miss why things happened or how the response unfolded; focusing only on a final resolution time omits the diagnostic trail and the coordination efforts. By including all five elements, the timeline becomes a reliable backbone for RCA and a transparent record for stakeholders.